FalconHound, attack path management for blue teams

This blog introduces FalconHound, a Golang-based tool that enriches BloodHound with near-real-time data from sources like Microsoft Sentinel, Defender for Endpoint, Splunk, Microsoft Graph, and Neo4j to help blue teams manage attack paths. It uses configurable actions to ingest log events (e.g., logons, role changes), create/update graph edges (including a new HadSession concept), and tag assets as owned, exploitable, or exposed. The enriched graph data can drive detections, watchlists, and analyst queries, enabling prioritization and lateral movement insights, while complementing periodic SharpHound/AzureHound collections.